HTTP: Dangerous ClassID in ActiveX Object Type 41

This signature detects Web pages containing dangerous ActiveX CLSID references. Malicious Web sites can exploit a known vulnerability in Internet Explorer and gain control of client browsers.

Extended Description

Microsoft Internet Explorer is prone to a buffer overflow vulnerability that is related to instantiation of COM objects. Successful exploitation could let remote attackers execute arbitrary code in the context of the currently logged in user on the affected computer. This is a variant of the vulnerability described in BID 14511 Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability. The difference between this issue and BID 14511 is that a different set of COM objects are affected that were not addressed in the previous BID.

Affected Products

Avaya s8100_media_servers,Microsoft visio_2002

References

BugTraq: 15061

CVE: CVE-2005-2127

URL: http://www.microsoft.com/technet/Security/bulletin/ms05-052.mspx http://www.us-cert.gov/cas/techalerts/TA05-221A.html

Short Name

HTTP:STC:CLSID:ACTIVEX:AX-41

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Dangerous ClassID in ActiveX Object Type 41

Extended Description

Affected Products

References

Found a potential security threat?